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(1) Real Party in Interest 

A statement identifying by name the real party in interest is contained in the brief. 

(2) Related Appeals and Interferences 

The following are the related appeals, interferences, and judicial proceedings 
known to the examiner which may be related to, directly affect or be directly affected by 
or have a bearing on the Board's decision in the pending appeal: 

An appeal decision was rendered on January 14, 2004 sustaining the prior art 
rejections. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is correct. 

(4) Status of Amendments After Final 

The appellant's statement of the status of amendments after final rejection 
contained in the brief is correct. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be reviewed on appeal is 
correct. 

(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(8) Evidence Relied Upon 
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5,835,726 



SHWED et al 



11-1998 



5,606,668 



SHWED 



02-1997 



(9) Grounds of Rejection 

The following ground(s) of rejection are applicable to the appealed claims: 
Claims 1-26 are rejected under 35 USC 102(e) as being anticipated by Shwed et 

al, U.S. Patent 5,835,726. 

Claims 1-26 are rejected under 35 USC 103(a) as being unpatentable over 

Shwed, U.S. Patent 5,606,668. 

(10) Response to Argument 

A. The Appellant argues that claims 1 ,8,12,17, and 22 were amended to recite 
"a security policy comprises multiple rules" and Independent claim 16 was amended to 
recite "a domain comprises at least one security policy and a security policy comprises 
multiple rules, and that a plurality of administrators are associated with the plurality of 
domains". 

I. It is argued by the Appellant that the limitations "a security policy comprises 
multiple rules" and that the "invention effectively provides a hierarchical rule selection 
procedure. That is, before a rule is applied to a particular packet, the appropriate 
security policy is first selected and then, a rule from the selected security policy is 
applied to the packet". It is asserted by the Appellant that Shwed 726 does not teach 
selecting a security policy having multiple rules among the selected security policy 
applied to the packet. 
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The Examiner respectfully disagrees with this assertion. The teachings of Shwed 
726 disclose of receiving a packet where control passes to block 410 in which code is 
generated to match the rule services that were chosen, or selected, and the rule 
services have been previously defined and a decision is then made as to whether to 
accept or reject the packet based on the security rule, see column 8, lines 19-33. The 
citation of Shwed recites that the given policy is pre-selected and that the rule services 
are based on filter scripts that contain the rules used by the packet filter, see column 8, 
lines 10-14. 

II. The Appellant states that "Shwed 726 does not teach or suggest selecting a 
security policy having multiple rules from among a plurality of security policies, each 
having multiple rules" and that "Shwed merely applies a rule from a single rule set 
associated with the packet filter residing on that computer". 

The Examiner disagrees with the Appellant's assertion. Firstly, the Examiner 
notes that the claim requirement only requires selection of a, or one, security policy 
to meet the claim requirement. Secondly, Shwed 726 recites that rule services are 
chosen, or selected, and when applied to the packet, it determines if the packet is to be 
accepted or rejected, see column 8, lines 19-33. Shwed 726 also recites "implementing 
a given security policy at a node, see column 2, lines 45-50, which implies selection of a 
security policy. Thirdly, the Examiner directs the Appellant to the appeal decision 
rendered on January 14, 2004 wherein the Appeal Board Judges indicated on page 5 of 
the decision that "the claimed invention is directed towards rule set selection, not just an 
individual rule selection" and "Shwed only refers to 'multiple security rules', not 'multiple 
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sets of rules". This is a key distinction because the Appellant has not claimed "multiple 
sets of rules", but rather multiple security rules that which is equivalent to security 
policies as indicated in the aforementioned Board decision. 

III. The Appellant presents arguments that Shwed does not teach "among a 
plurality of administrators associated with a plurality of domains, only an administrator 
for a given domain is permitted to modify rules of a security policy for that domain as in 
claim 16." 

The Examiner respectfully disagrees. Shwed 726 recites that there exists 
multiple administrators for a plurality of domains by disclosing that there can exist a 
number of network configurations that can be virtually endless, and configuring a 
plurality of domains with a plurality of administrators, see column 5, lines 39-54. Shwed 
726 further teaches controlling data flow to groups of computers on the network and 
allowing system operators, or administrators, to provide internal and external security by 
allowing them to have flexibility in managing the communications, see column 6, line 65 
through column 7, line 16. In this cited passage, the system administrator determines 
both internal and external network security settings for each department, or domain, 
wherein each has an established security policy. It is further taught by Shwed 726 that 
the system administrator enters the security rules and can make changes to the security 
rules so that the security of the network is maintained, see column 6, lines 39-54. 

B. The Appellant lists the Examiner's statement that "a security policy is a 
collection of rules that dictate how the security policy is to be enforced". 
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I. Appellant comments "that there is no ability disclosed in the Shwed system to 
have a packet filter receive a packet, then select a security policy from among a plurality 
of security policies, and then apply the rule set associated with the selected policy." 
Shwed 726 merely applies "a given security policy to a packet and does not select a 
security policy from among a plurality of security polices". The Appellant further argues 
that there is "no policy selection followed by rule selection in a packet filter of Shwed". 

The Examiner respectfully disagrees. Firstly, the Examiner notes that the claim 
requirement only requires selection of a, or one, security policy to meet the claim 
requirement. Secondly, Shwed 726 recites that rule services are chosen, or selected, 
and when applied to the packet, and determines if the packet is to be accepted or 
rejected, see column 8, lines 19-33. Shwed 726 also recites of "implementing a given 
security policy at a node, see column 2, lines 45-50, that which implies selection of a 
security policy. Thirdly, the Examiner directs the Appellant to the appeal decision was 
rendered on January 14, 2004 wherein the Appeal Board Judges indicated on page 5 of 
the decision that "the claimed invention is directed towards rule set selection, not just 
individual rule selection" and "Shwed only refers to 'multiple security rates', not 'multiple 
sets of rules 01 . This is a key distinction because the Appellant has not claimed "multiple 
sets of rules", but rather multiple security rules that which is equivalent to security 
policies as indicated in the decision on page 7 of the decision rendered on January 14, 
2004. 

II. The Appellant has argued that Shwed can not disclose "selecting at least one 
of a plurality of security policies as a function of a session key, wherein a security policy 
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comprises multiple rules, and using the selected at least one security policies in 
validating the packet" as is recited in claims 1,17, and 22, furthermore, nor can Shwed 
disclose "designating a plurality of independent security policies, wherein a security 
policy comprises multiple rules, determining which security policy is appropriate for the 
packet, and validating the packet using a portion of the multiple rules of the determined 
security policy as is recited in claims 8 and 12. 

The Examiner respectfully disagrees. Firstly, the Examiner notes that the claim 
requirement only requires selection of a, or one, security policy to meet the claim 
requirement. Secondly, Shwed discloses of firewalls that contain rule bases for inbound 
and outbound communications whereby the communications are encrypted using a 
session key that is agreed on by both parties, see column 14, line 59 through column 
1 5, line 1 1 . The session keys must be exchanged prior to proceeding with encrypted 
communications between the two parties, see column 15, lines 33-43. Thirdly, Shwed 
726 recites that rule services are chosen, or selected, then applied to the packet to 
determine if the packet is to be accepted or rejected, see column 8, lines 19-33. Shwed 
726 also recites of "implementing a given security policy at a node, see column 2, lines 
45-50, that which implies selection of a security policy. Fourthly, the Examiner directs 
the Appellant to the appeal decision was rendered on January 14, 2004 wherein the 
Appeal Board Judges indicated on page 5 of the decision that "the claimed invention is 
directed towards rule set selection, not just individual rule selection" and "Shwed only 
refers to 'multiple security rules', not 'multiple sets of rules' 11 . This is a key distinction 
because the Appellant has not claimed "multiple sets of rules", but rather multiple 
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security rules that which is equivalent to security policies as indicated in the decision on 
page 7 of the decision rendered on January 14, 2004. Lastly, Shwed 726 recites that 
the selected security rule is used to validate the packet, see column 8, lines 19-31 . 

III. The Appellant states that Shwed does not disclose "administering the 
multiple rules such that only an administrator for a given domain is permitted to modify 
rules of a security policy for that domain". 

The Examiner respectfully disagrees. Shwed 726 recites that there exists 
multiple administrators for a plurality of domains by disclosing that there can exist a 
number of network configurations that can be virtually endless, and configuring a 
plurality of domains with a plurality of administrators, see column 5, lines 39-54. Shwed 
726 further teaches controlling data flow to groups of computers on the network and 
allowing system operators, or administrators, to provide internal and external security by 
allowing them to have flexibility in managing, or through making modifications, the 
communications, see column 6, line 65 through column 7, line 16. In this cited passage, 
the system administrator determines both internal and external network security settings 
for each department, or domain, wherein each has an established security policy. It is 
further taught by Shwed 726 that the system administrator enters the security rules and 
can make changes to the security rules so that the security of the network is maintained 
that does not affect communications, see column 6, lines 39-54. 

IV. The Appellant states that Shwed '668 suffers from the same deficiencies as 
Shwed 726. Appellant comments "that there is no ability disclosed in the Shwed 
system to have a packet filter receive a packet, then select a security policy from among 
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a plurality of security policies, and then apply the rule set associated with the selected 
policy." Shwed '668 merely applies "a given security policy to a packet and does not 
select a security policy from among a plurality of security polices". The Appellant further 
argues that there is "no policy selection followed by rule selection in a packet filter of 
Shwed". 

The Examiner respectfully disagrees. Firstly, the Examiner notes that the claim 
requirement only requires selection of a, or one, security policy to meet the claim 
requirement. Secondly, Shwed '668 recites that rule services are chosen, or selected, 
and when applied to the packet, and determines if the packet is to be accepted or 
rejected, see column 6, lines 12-25. Shwed '668 also recites of "implementing a given 
security policy at a node, see column 2, lines 1-4, that which implies selection of a 
security policy. Thirdly, the Examiner directs the Appellant to the appeal decision was 
rendered on January 14, 2004 wherein the Appeal Board Judges indicated on page 5 of 
the decision that "the claimed invention is directed towards rule set selection, not just 
individual rule selection" and "Shwed only refers to 'multiple security rules\ not 'multiple 
sets ofrules m . This is a key distinction because the Appellant has not claimed "multiple 
sets of rules", but rather multiple security rules that which is equivalent to security 
policies as indicated in the decision on page 7 of the decision rendered on January 14, 
2004 

V. The Appellant presents arguments that Shwed does not teach "among a 
plurality of administrators associated with a plurality of domains, only an administrator 
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for a given domain is permitted to modify rules of a security policy for that domain as in 
claim 16." 

The Examiner respectfully disagrees. Shwed '668 recites that there exists 
multiple administrators for a plurality of domains by disclosing that there can exist a 
number of network configurations that can be virtually endless, and configuring a 
plurality of domains with a plurality of administrators, see column 3, lines 27-43. Shwed 
'668 further teaches controlling data flow to groups of computers on the network and 
allowing system operators, or administrators, to provide internal and external security by 
allowing them to have flexibility in managing, or through making modifications, the 
communications, see column 4, line 53 through column 5, line 5. In this cited passage, 
the system administrator determines both internal and external network security settings 
for each department, or domain, wherein each has an established security policy. It is 
further taught by Shwed 726 that the system administrator enters the security rules and 
can make changes to the security rules so that the security of the network is maintained 
that does not affect communications, see column 4, lines 27-42. 

VI. The Appellant states the Examiner indicated "processing the extracted data 

packet in the Shwed invention would be recognized by one of ordinary skill in the 

art.... as an obvious equivalent to deriving a session key for an incoming packet, 
because a session key indicates which security rules to use for the particular packet". 
The Appellant then contends that the Examiner has failed to identify an objective 
evidence of record which would support modification of Shwed '668 to obtain this 
feature and statements are just "subjective belief and unknown authority". 
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The Examiner indicates that the Appellant has not addressed this statement in 
previous responses challenging the examiner for evidence, so it is rendered moot since 
this was not seasonably challenged upon the first submission of the statement by the 
Examiner in the first non-final office action mailed on August 18, 1999. Lastly, the 
claims were viewed as a whole by the Appeal Board Judges whereby a decision was 
rendered on January 14, 2004 that included this statement by the Examiner. On page 5 
of the decision mailed January 14, 2004, "it has been determined that Appellant's 
arguments in the Brief do not dispute the assertion of a session key as being equivalent 
to the extraction of packet data to determine the applicability of a security rule in 
Shwed". A Board of Patent Appeals and Interferences decision in an application has 
res judicata effect and is the "law of the case" and is thus controlling in that application 
and any subsequent, related application. Therefore, a submission containing arguments 
without either an amendment of the rejected claims or the submission of a showing of 
facts will not be effective to remove such rejection. See MPEP § 706.03(w) and 
1214.01 . The arguments of the session key are substantially similar to the issues 
already decided by the Board of Patent Appeals and the Appellant's arguments are 
moot. 

In summary of Shwed '668, the Examiner directs the Appellant to the appeal 
decision rendered on January 14, 2004. The rejection of claims 1-26 has been 
previously upheld as decided by the Appeal Board Judges in that is clearly teaches 
each and every element of the Appellant's claim language, the matter of issues now 
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reside in the fact of whether or not Shwed 726 and Shwed '668 disclose a "security 
policy comprises multiple rules" and "a domain comprises at least one security policy 
and a security policy comprises multiple rules, and that a plurality of administrators are 
associated with the plurality of domains" in which the Examiner contends that both 
Shwed 726 and Shwed '668 discloses. 

(11) Related Proceeding(s) Appendix 

Copies of the court or Board decision identified in the Related Appeals and 
Interferences section of this examiner's answer are provided accompanying this 
Examiner's Answer. 

For the above reasons, it is believed that the rejections should be sustained. 
Respectfully submitted, 




pher Revak 




Primary Examiner 
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Primary Examiner 
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The opinion in support of the decision being entered today was not 
written for publication and is not binding precedent of the Board. 
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Ex parte MICHAEL JOHN COSS, DAVID L. MAJETTE, and 

RONALD L. SHARP 



Appeal No. 2002-0299 
Application No. 08/927,382 

ON BRIEF 



Before KRASS, JERRY SMITH, and RUGGIERO, Administrative Patent 
Judges . 

RUGGIERO, Administrative Patent Judge . 

DECISION ON APPEAL 

This is a decision on the appeal from the final rejection of 
claims 1-26, which are all of the claims pending in the present 
application. ~ ~ . * 

The disclosed invention relates to a system and method for 
implementing a computer network firewall by applying a security 
policy represented by a set of access rules for a given 
communication packet* 
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Claim 1 is illustrative of the invention and reads as 
follows : 

1. A method for validating a packet in a computer network, 
comprising the steps of: 

deriving a session key for said packet; 

selecting at least one of a plurality of security 
policies as a function of the session key; and 

using the selected at least one of the security 
policies in validating said packet. 

The Examiner relies on the following prior art: 
Shwed 5,606, 668 Feb. 25, 1997 

Claims 1-26, all of the appealed claims, stand finally 
rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Shwed. 

Rather than reiterate the arguments of Appellants and the 
Examiner, reference is made to the Briefs, 1 the final Office 
action, and Answer for the respective details. 

OPINION 

We have carefully considered the subject matter on appeal, 
the rejection advanced by the Examiner, The arguments in support" 



x The Appeal Brief was filed July 17, 2000 (Paper No. 13) . In 
response to the Examiner's Answer dated September 26, 2000 (Paper No. 
14), a Reply Brief was filed November 30, 2000, (Paper No. 15), which 
was acknowledged and entered by the Examiner as indicated in the 
communication dated December 15, 2000 (Paper No. 16), 
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of the rejection, and the evidence of obviousness relied upon by 
the Examiner as support for the rejection. We have, likewise, 
reviewed and taken into consideration, in reaching our decision, 
Appellants' arguments set forth in the Briefs along with the 
Examiner's rationale in support of the rejection and arguments in 
rebuttal set forth in the Examiner's Answer. 

It is our view, after consideration of the record before us, 
that the evidence relied upon and the level of skil l in the 
particular art would have suggested to one of ordinary skill in 
the art the obviousness of the invention as set forth in claims 
1-26. Accordingly, we affirm. 

Appellants nominally indicate (Brief, page 3) that the 
claims on appeal stand or fall together as two separate groups. 
For the first group including claims 1-15 and 17-26, we will 
select claim 1 as the representative claim and claims 2-15 and 
17-26 will stand or fall with claim 1. Claim 16, grouped and 
argued separately by Appellants, will be considered 
independently. NoteJCn re King , 801 F\2d 1324, J.325, 231 USPQ 
136, 137 (Fed. Cir. 1986); In re Sernaker , 702 F.2d 989, 991, 217 
USPQ 1, 3 (Fed. Cir. 1983) . Only those arguments actually made 
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by Appellants have been considered in this decision. Arguments 
which Appellants could have made but chose not to make in the 
Briefs have not been considered ( see 37 CFR § 1.192(a)). 

As a general proposition in an appeal involving a rejection 
under 35 U.S. C. § 103, an Examiner is under a burden to make out 
a prima facie case of obviousness. If that burden is met, the 
burden of going forward then shifts to Appellants to overcome the 
prima facie case with argument and/or evidence. Obviousness is 
then determined on the basis of the evidence as a whole and the 
relative persuasiveness of the arguments. See In re Oetiker , 977 
F.2d 1443, 1445, 24 USPQ2d 1443, 1444 (Fed. Cir. 1992); In re 
Hedges , 783 F.2d 1038, 1039, 228 USPQ 685, 686 (Fed. Cir. 1986); 
In re Piasecki , 745 F.2d 1468, 1472, 223 USPQ 785, 788 (Fed. Cir. 
1984); and In re Rinehart , 531 F.2d 1048, 1051-52, 189 USPQ 143, 
147 (CCPA 1976) . 

With respect to representative claim 1, Appellants' 
arguments in response to the obviousness rejection assert that 
the E xaminer has failed to establish a prima facie case of 
obviousness since all of the claimed limitations are not taught 
or suggested by the applied prior art references. In particular, 
Appellants contend (Brief, page 5) that, in contrast to the 
language of claim 1 which requires the selection from a plurality 

4 
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of security policies, Shwed merely selects from plural rules in a 

single rule set or security policy. Appellants amplify their 

arguments by asserting (Brief, page 6) that, unlike Shwed, 

* . . . the claimed invention is directed toward rule set 

selection not just individual rule selection" and also that 

*. . . Shwed only refers to ^multiple security rules' . . . not 

multiple sets of rules." 2 

.After careful review of the Shwed reference in light of the 
arguments of record, however, we are in agreement with the 
Examiner's position as stated in the Answer. In our view, the 
Examiner's assertion (Answer, page 3) that the claimed 'security 
policies" correspond to Shwed' s security rules is a reasonable 
interpretation of the claim language when considered in light of 
Appellants' specification. We note that it is a basic tenet of 
patent law that claims are to be given their broadest reasonable 
interpretation consistent with the description in the 
specification. 



2 In the obviousness rationale set forth by the Examiner (final 
Office action, page 3), it is asserted that the extraction of packet 
data to determine the applicability of a security rule in Shwed would 
be obviously recognized and appreciated by the skilled artisan as 
corresponding to the claimed ^session key." Appellants' arguments in 
the Briefs do not dispute this assertion and we find no error in the 
Examiner's stated position. 
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With the above discussion in mind, we have reviewed 
Appellants' specification for guidance as to the proper, 
interpretation of the claim language and we find little 
enlightenment as to how to properly interpret the "security 
policies" language of representative claim 1. Appellants' 
argument (Reply Brief, page 2) in support of their position as to 
the proper interpretation of the language of claim 1 refers to 
the portions of their specification at page 5, lines 1 and 2 and 
lines 23 and 24. We do not find this persuasive. The excerpt at 
page 5, lines 1 and 2 merely states that a single firewall can 
support multiple users where each user might have a separate 
security policy. 

Similarly, in our view, the portion at page 5, lines 23 and 
24 which states that "security policies can [our emphasis] be 
represented by sets of access. rules/ 7 rather than supporting 
Appellants' asserted restrictive interpretation of "security 
policies," instead suggests a broader and more inclusive 
interpretation. Given the paucity of„ .description in Appellants' _ 
specification as to the nature of a "security policy," we can 
only reach the conclusion that the "security policies" language 
of representative claim 1 simply does not require the 
interpretation asserted by Appellants in the Briefs. In our 
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opinion, we find no error in the Examiner's interpretation of the 
claimed * security policies" as corresponding to Shwed' s security 
rules in which each rule can be considered a security policy, 
especially in view of the fact that there is no proscription 
against a rule set or security policy having only one rule in the 
set . 

Fpr the above reasons, since it is our opinion that the 
Examiner' s prima facie case of obviousness has not been overcome 
by any convincing arguments from Appellants, the. Examiner' s 
35 U.S.C. § 103(a) rejection of representative independent claim 
1, as well as claims 2-15 and 17-26 which fall with claim 1, is 
sustained. 3 

We also sustain the Examiner's 35 U.S.C. § 103(a) rejection 
of independent claim 16, grouped and argued separately by 
Appellants. Although claim 16 is directed to the feature of 
permitting modification of domain access rules only by an 
administrator for a given domain, Appellants' arguments are an 
extension of those made previously with regard to claim 1. In 




3 While Appellants have grouped (Brief, page 3) claims 1-15 and 
17-2 6 as a single group which stand or fall together, the Brief at 
pages 8-10 briefly discusses the merits of all of the claims. The 
extent of these arguments, however, relies on Appellants' asserted 
interpretation of "plural security policies" as multiple sets of 
rules, an assertion which we have found to be unpersuasive as. 
discussed supra . 

7 
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Appellants' view (Brief, pages 10 and 11; Reply Brief, page 7), 
since Shwed's system involves selective placement of packet 
filters where each filter has a single set of rules in contrast 
to Appellants' system which has separate rule sets (security 
policies) in a single firewall, Shwed has no disclosure of 
independent administration of respective security policies as 
claimed. Appellants go on to assert that Shwed's system suggests 
a single administrator for the entire single rule set rather than 
a separate administrator for each domain. 

It is our view, however, that the requirements of appealed 
claim 16 do not distinguish over the system described by Shwed at 
least in the manner broadly claimed by Appellants. Even 
assuming, arguendo , that Appellants' suggestion that Shwed has a 
single administrator for all domains is correct, this single 
administrator would also be an administrator for a given domain 
as claimed. 

In summary, we have sustained the Examiner's 35 U.S.C. 
§ 103(a) rejection of all of the claims on appeal. Therefore, 
the decision of the Examiner rejecting claims 1-26 is affirmed. 
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No time period for taking any subsequent action in 
connection with this appeal may be extended under 37 CFR 
§ 1.136 (a) . 



AFFIRMED 




ERROL A. KRASS 
Administrative Patent Judge 




Judge 



BOARD OF PATENT 
APPEALS AND 
INTERFERENCES 




'JOSEPH F. RUGGIERO 
Administrative Patent Judge 



JFR/hh 
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